Policy · Market structure · Update
Three Clauses Now Decide What Counts as Decentralized
Nine days ago there was a cloture date and no finished text. There is now a 630-page substitute. Most coverage summarised its DeFi change as "controlled protocols register with the CFTC." The bill itself is narrower on registration, broader on regulators, and has a clause about security councils that nobody in the headlines mentioned.
When this desk previewed the September 15 cloture vote on September 3, the complaint was simple: the Senate had a date and no text that resolved anything. On Thursday, September 10, Senator Cynthia Lummis's office posted one — a 630-page amendment in the nature of a substitute to H.R. 3633, file number EHF26718, first reported by Decrypt.
Lummis described the change as "specifying when decentralized-in-name-only DeFi protocols must register with the CFTC and limiting the DeFi provisions to spot and cash transactions," per Decrypt and Bitcoin Foundation. That one sentence became most of the coverage. The text is worth reading past it, because the operative language does not quite say what the summary says.
The three tests
The bill starts from a broad category. A "decentralized finance trading protocol" is a distributed ledger system through which participants execute a financial transaction under a predetermined, non-discretionary rule, without relying on anyone other than the user to hold custody. It then carves out a subset called a "non-decentralized finance trading protocol." A protocol falls into it if it meets one or more of three conditions:
Control. A person or coordinated group has authority, "directly or indirectly," to "control or materially alter the functionality, operation, or rules of consensus" of the protocol.
Off-code operation. The protocol does not run "based solely on pre-established, transparent rules encoded directly within the source code."
Restriction. A person or coordinated group can, through the protocol itself, "restrict, censor, or prohibit" its use.
One test is enough. A protocol whose contracts are immutable and whose parameters no one can change could still land in the category if a single address can block users from it. Two limits soften that: a decentralized governance system does not count as a coordinated group "solely by virtue of" operating, and taking part in an incident-response or security council does not, by itself, count as control.
Written in twice, for two regulators
Most of the headlines named only the CFTC. The text writes the same definition into the bill twice. Section 10301, in the Banking Committee's division, directs the SEC, working with Treasury, to write rules for controlling persons subject to the Securities Exchange Act. Section 20209(b), in the Agriculture Committee's division, directs the CFTC, working with the SEC and Treasury, to do the same under the Commodity Exchange Act. Cointelegraph described it as SEC and CFTC rulemaking. That matches the text. Crypto in America reported the DeFi language as newly added to the Agriculture section.
One definition, two divisions
| Provision | Banking division | Agriculture division |
|---|---|---|
| Three-test definition | §10301(a)(2), p.167 | §20209(b)(1)(B), p.581 |
| Lead rule-writer | SEC, with Treasury | CFTC, with SEC and Treasury |
| Bank Secrecy Act rules | Treasury | Treasury |
| Activities in scope | Securities-related | Digital commodity-related |
| Security-council carve-out | §10301(f)(2), p.175 | §20209(b)(6)(B), p.590 |
On registration, the wording is careful. Neither regulator is told that controlled protocols must register. Each is told to write rules that "clarify how" a person who controls one, and who is already subject to that regulator's statute, complies "including with respect to registration." Both sections say nothing in them may be read to require "a distributed ledger system or any software code to register" in its own right, or to prohibit launching one. Both also rule out any presumption that a given person is or is not covered until a rulemaking decides. Obligations attach to functions, listed as brokerage, dealing, trading, execution, clearing and custody, "without regard to technological form, distributed architecture, or purportedly decentralized characterization."
Put plainly, the bill doesn't create a registry of controlled protocols. It creates a test for which people behind a protocol get treated like the intermediary they functionally are, and it leaves the detail to two agencies' notice-and-comment processes. None of that work starts unless the bill becomes law.
The clause about the pause button
The third test is the one security teams should read twice. Any trading protocol with an address that can pause a market or block a user holds a power that, on the plain words of that test, is enough on its own. This desk has spent recent weeks covering emergency powers in use, Cronos halting its own chain among them.
The bill's answer is a carve-out with a lot of conditions attached. Emergency measures by an incident-response or security council do not, by themselves, amount to common control, but only if they are:
- pre-defined, temporary and rules-based;
- used only for a "specific and documented" incident or imminent threat;
- authorised through publicly disclosed onchain mechanisms;
- limited in scope and duration;
- not under unilateral control by any single person;
- written up, with procedures and limits, in public documentation available to the regulator "sufficiently in advance" of any use.
The same powers may not be used for upgrades, governance decisions or economic changes unrelated to the incident. The detailed standards are left to rulemaking.
The carve-out did appear in Cointelegraph's account of the revision. The crypto.news and The Crypto Basic write-ups this desk read did not mention it.
What did not move
The dispute that stalled the bill before recess is still unresolved. Cointelegraph and crypto.news both report the ethics section as largely unchanged from July. Crypto.news adds that terms proposed by Senator Thom Tillis with Democratic senators were not taken up. Per Decrypt, Lummis says Republicans accepted more than 114 provisions Democrats sought.
The reactions split along the same line. Coinbase CEO Brian Armstrong said the bill was "ready to get a yes vote," per Cointelegraph. Senator Ruben Gallego, one of the Democrats negotiating the ethics language, said: "A fast vote gets you a fast result, but I'm not sure it's the result you want."
The arithmetic has also worsened since this desk's preview. That piece noted Republicans cannot reach sixty alone and would need at least seven votes from outside the conference. Crypto in America now reports that at least two Republicans are expected to oppose the motion. With 53 Republican seats, that means nine Democratic votes would be needed. Crypto in America names Senators Jerry Moran and Josh Hawley as possible no votes over community-bank concerns.
The vote is set for 2:15 p.m. Eastern on Tuesday. Nothing in the revised DeFi text changes what that vote is: permission to debate, not passage.
The Take
The definition is better drafted than its coverage. "Controlled protocols must register with the CFTC" suggests a new registry. The text is an activity test aimed at the people who hold the keys, with an explicit bar on treating code as a registrant. That is a defensible line, and more careful than the "decentralized-in-name-only" slogan it is being sold under. The more consequential sentence for this desk's readers is the security-council carve-out, because it turns incident response into a disclosure question. A team that can pause a protocol and has written down in advance who may do so, for what, for how long and through which onchain mechanism, has an argument that the pause is not control. A team that improvises, however well-meaning and however fast, has a clause suggesting it is. Whether or not this bill survives Tuesday, that is the right standard for emergency powers, and teams could start documenting theirs now at no cost. The bill's weakness is not this language. It is the unchanged ethics section, which no drafting quality in Title III will fix.